Dante SOCKS Proxy Server on AWS User Guide

Overview

Dante is a free, robust, circuit level SOCKS server from Inferno Nettverk. This cloudimg image runs the sockd daemon (danted) as a self hosted SOCKS4 and SOCKS5 forward proxy you run and control entirely in your own AWS account. Point a SOCKS aware client or application at the instance on TCP port 1080 and its traffic is relayed through the proxy, so you can centralise and credential gate outbound egress, reach internal services over an authenticated tunnel, or give automation a controlled proxy endpoint you own.

Secure by design — no default credentials, never an open relay. A proxy that anyone can use anonymously is an open relay, so this image never ships a fixed or shared credential. On the very first boot of every instance a fresh per instance proxy username and password are generated into a dedicated nologin account and written to /root/dante-credentials.txt (mode 0600, root only). SOCKS authentication is mandatory (socksmethod: username), so anonymous or wrong credential requests are rejected at method negotiation.

Locked down by default. Client access is restricted to loopback and RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); every other source is blocked before authentication even begins. The daemon starts privileged only long enough to check passwords, then drops to the unprivileged nobody account for the relay children. You widen access to your own client ranges with one config edit.

What is included:

• Dante dante-server (the sockd/danted daemon) installed from the Ubuntu 24.04 universe repository, run under systemd as danted.service

• A SOCKS4/SOCKS5 forward proxy on TCP 1080

• Mandatory SOCKS authentication (socksmethod: username) against a per instance account, so anonymous requests are rejected

• A per instance username and password generated on first boot, documented in /root/dante-credentials.txt (0600, root only)

• A secure default access control list: loopback and RFC1918 private sources only, with a deny all default and least privilege relay children

Prerequisites

• An active AWS account and a subscription to the Dante listing on AWS Marketplace

• An EC2 key pair for SSH administration

• A security group allowing TCP 22 (administration) and TCP 1080 (SOCKS) from the client networks that will use the proxy

Recommended instance type: m5.large (2 vCPU, 8 GB RAM) for general use; scale up for higher concurrent throughput.

Step 1: Subscribe and launch from AWS Marketplace

Find the Dante listing published by cloudimg on AWS Marketplace, subscribe, and choose Launch through EC2. Select your key pair, and configure the security group to allow TCP 1080 from your client networks and TCP 22 for administration.

To launch the same AMI from the AWS CLI (replace the placeholders with your own values):

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <security-group-id> \
  --subnet-id <subnet-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=dante-proxy}]'

Step 2: Connect to your instance

Connect over SSH as your operating system variant's default login user:

ssh -i <your-key>.pem ubuntu@<public-ip>

Step 3: Read your per-instance credentials

A unique proxy username and password are generated on first boot and written to a root-only file. Read them with:

sudo cat /root/dante-credentials.txt

The file contains PROXY_USERNAME= and PROXY_PASSWORD= lines plus the SOCKS endpoint. Keep these credentials safe — they are unique to this instance and are what your clients authenticate with.

Step 4: Confirm the service and listening port

Dante runs under systemd and listens for SOCKS clients on TCP 1080:

sudo systemctl status danted --no-pager | head -n 5

sudo ss -tlnp | grep 1080

Confirm the credentials file exists and is root-only (0600), without printing its contents:

sudo ls -l /root/dante-credentials.txt

Step 5: Prove the authenticated proxy round-trip

Read the per-instance credentials into shell variables (they are never printed), then make a request through the proxy. The request egresses via the instance, so the returned address is the instance's own public IP:

PROXY_USER=$(sudo grep '^PROXY_USERNAME=' /root/dante-credentials.txt | cut -d= -f2-)
PROXY_PASS=$(sudo grep '^PROXY_PASSWORD=' /root/dante-credentials.txt | cut -d= -f2-)
curl -s -x "socks5h://$PROXY_USER:$PROXY_PASS@127.0.0.1:1080" https://api.ipify.org
echo

Now prove the proxy is not an open relay — an anonymous request (no credentials) is rejected at SOCKS method negotiation:

if curl -s -o /dev/null -m 15 -x socks5h://127.0.0.1:1080 https://api.ipify.org; then
  echo "UNEXPECTED: anonymous request succeeded"
else
  echo "anonymous request correctly rejected (not an open relay)"
fi

Step 6: Use the proxy from your client

From a client on an admitted network, point any SOCKS aware application at the instance on port 1080 using the per-instance username and password. For example, with curl from your workstation (replace with your instance address and credentials):

curl -x socks5h://PROXY_USERNAME:PROXY_PASSWORD@<public-ip>:1080 https://ifconfig.me

Most browsers, SSH (ssh -o ProxyCommand), and language HTTP libraries accept a SOCKS5 proxy with authentication in the same way.

Step 7: Widen access to your own client networks

By default only loopback and RFC1918 private sources are admitted. To allow your own remote client range, add a client pass block for that CIDR in /etc/danted.conf above the final client block, then reload:

sudo nano /etc/danted.conf
# add, for example:
#   client pass { from: 203.0.113.0/24 to: 0.0.0.0/0 }
sudo systemctl reload danted

Remember to also open TCP 1080 in the instance's security group for those client networks.

Security model

• Authentication is mandatory. socksmethod: username requires a valid username and password on every SOCKS request; anonymous and wrong credential requests are rejected.
• No shared credentials. Each instance mints its own random proxy account on first boot; nothing is baked into the image.
• Not an open relay. Client access is restricted to loopback and RFC1918 private ranges by default; all other sources are blocked before authentication.
• Least privilege. The daemon drops to the unprivileged nobody account for relay children; only a minimal privileged helper reads the system password database.
• Managed under systemd. danted.service starts on boot and restarts on failure.

Support

cloudimg provides 24/7 technical support for this image by email and live chat at support@cloudimg.co.uk — deployment, source access rules and client ranges, authentication configuration, egress design, and backup planning.